Research map / Adversarial robustness and security / Black-box and transfer attacks
LogoStyleFool: Vitiating Video Recognition Systems via Logo Style Transfer
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes LogoStyleFool, a black-box video attack that superimposes a RL-searched, style-transferred logo in a corner of the video and then refines the logo region with a DCT-based SimBA variant (LogoS-DCT) to reach targeted attacks.
Problem
Black-box adversarial attacks on video recognition are either global style perturbations (less natural, easily detected) or patch-based RL attacks that are restricted to untargeted attacks due to limited RL search space.
Approach
Three-stage attack: select style references via block-wise SimBA, use RL to choose logo, style, position and scale with a reward penalizing logo area and distance to corners, then run a perturbation optimization (LogoS-DCT) restricted to the logo mask to make targeted attacks feasible; proves l_inf and l2 bounds on the regional perturbation.
Key results
- On UCF-101 targeted attacks against C3D, LogoStyleFool-l2 reaches 58% fooling rate versus 16% for BSC and 6% for PatchAttack.
- On HMDB-51 untargeted attacks against I3D, LogoStyleFool-l_inf achieves 100% fooling rate with 925.9 average queries versus 1,305.4 for BSC.
- Against LGS and PatchCleanser defenses, LogoStyleFool's fooling rate is on par with competing patch attacks (e.g., 40-55% on UCF-101 for C3D/I3D).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add LogoStyleFool with perturbation optimization after RL | C3D · UCF-101 targeted | fooling rate: 16% -> 58% | Helped |
| add LogoStyleFool with perturbation optimization after RL | I3D · UCF-101 targeted | fooling rate: 14% -> 42% | Helped |
| add LogoStyleFool with perturbation optimization after RL | C3D · HMDB-51 targeted | fooling rate: 15% -> 73% | Helped |
| add LogoStyleFool with perturbation optimization after RL | I3D · HMDB-51 targeted | fooling rate: 21% -> 69% | Helped |
| skip style-reference selection and use random style images (ablation) | LogoStyleFool · UCF-101 targeted | fooling rate: 55% -> 29% | Hurt |
| initialize the style image with solid color (ablation) | LogoStyleFool · UCF-101 targeted | fooling rate: 55% -> 32% | Hurt |
| remove the logo-area penalty (ablation) | LogoStyleFool · UCF-101 untargeted | average query: 1,587.7 -> 538.1 | Helped |
| remove the logo-to-corner distance penalty (ablation) | LogoStyleFool · UCF-101 untargeted | average query: 1,587.7 -> 505.2 | Helped |
| remove the logo-area penalty (ablation) | LogoStyleFool · UCF-101 targeted | fooling rate: 55% -> 55% | No clear effect |
| remove the logo-to-corner distance penalty (ablation) | LogoStyleFool · UCF-101 targeted | fooling rate: 55% -> 53% | No clear effect |
| limit perturbation optimization to one round (ablation) | LogoStyleFool · UCF-101 targeted | fooling rate: 55% -> 27% | Hurt |
| optimize one point per frame in each step (ablation) | LogoStyleFool · UCF-101 targeted | fooling rate: 55% -> 19% | Hurt |
Surprising findings
- Increasing RL batch size does not significantly improve fooling rate but increases average query, suggesting RL may fail to find adversarial examples even with a large search space.
- Random style images are often already adversarial, so skipping style reference selection sharply reduces untargeted queries.
Limitations
- Targeted attacks still require about 20,000 queries on average and some fail under the query limit.
- Stage 3 perturbation optimization makes the attack more detectable by defenses, reducing evasion capability.
- Target models are limited to C3D and I3D on two small datasets.
Experimental setup
Datasets: UCF-101 HMDB-51 LLD
Benchmarks: UCF-101 HMDB-51
Metrics: fooling rate average query average occluded area temporal inconsistency fooling rate under LGS and PatchCleanser defenses
Baselines: Adv-watermark PatchAttack BSC Sparse-RS V-BAD StyleFool
Builds on: SimBA SimBA-DCT PatchAttack Adv-watermark BSC
Closest papers by meaning
- Boosting the Transferability of Video Adversarial Examples via Temporal Translation (AAAI 2022 · similarity 0.86)
- I2VGuard: Safeguarding Images against Misuse in Diffusion-based Image-to-Video Models (CVPR 2025 · similarity 0.84)
- Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Models (CVPR 2025 · similarity 0.83)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.83)
- Boosting the Transferability of Adversarial Attack on Vision Transformer with Adaptive Token Tuning (NeurIPS 2024 · similarity 0.83)
- Reinforcement Learning Platform for Adversarial Black-box Attacks with Custom Distortion Filters (AAAI 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.